@kamod-ch/otok-auth 2.0.0

package/dist/csrf.js

@@ -0,0 +1,53 @@
+import { timingSafeEqual } from "node:crypto";
+import { getCookie, setCookie } from "hono/cookie";
+import { fail } from "@kamod-ch/otok/server";
+import { randomToken } from "./crypto.js";
+export const CSRF_FIELD = "_csrf";
+export const DEFAULT_CSRF_COOKIE = "otok_csrf";
+function resolveSecure(c, secure) {
+    if (typeof secure === "function")
+        return secure(c);
+    if (typeof secure === "boolean")
+        return secure;
+    return process.env.NODE_ENV === "production";
+}
+export function createCsrfToken() {
+    return randomToken(24);
+}
+/** Ensure a CSRF cookie exists on safe requests (GET/HEAD). */
+export function ensureCsrfCookie(c, options = {}) {
+    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE;
+    const existing = getCookie(c, cookieName);
+    if (existing)
+        return existing;
+    const token = createCsrfToken();
+    setCookie(c, cookieName, token, {
+        httpOnly: false,
+        sameSite: options.sameSite ?? "Lax",
+        path: options.path ?? "/",
+        secure: resolveSecure(c, options.secure),
+        maxAge: options.maxAge,
+    });
+    return token;
+}
+export function verifyCsrf(c, formToken, options = {}) {
+    const cookieName = options.cookieName ?? DEFAULT_CSRF_COOKIE;
+    const cookie = getCookie(c, cookieName);
+    if (!cookie || !formToken)
+        return false;
+    const a = Buffer.from(cookie);
+    const b = Buffer.from(formToken);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+/** Reject mutating form posts when the cookie and form field do not match. */
+export function assertCsrf(c, formData, options = {}) {
+    const submitted = String(formData?.get(CSRF_FIELD) ?? "");
+    if (!verifyCsrf(c, submitted, options)) {
+        fail(403, { message: "Invalid CSRF token" });
+    }
+}
+/** Hidden input snippet for progressive-enhancement forms. */
+export function csrfHiddenInput(token) {
+    return `<input type="hidden" name="${CSRF_FIELD}" value="${token}" />`;
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC;AAClC,MAAM,CAAC,MAAM,mBAAmB,GAAG,WAAW,CAAC;AAU/C,SAAS,aAAa,CAAC,CAAU,EAAE,MAA4C;IAC7E,IAAI,OAAO,MAAM,KAAK,UAAU;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IACnD,IAAI,OAAO,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC/C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,gBAAgB,CAAC,CAAU,EAAE,UAAuB,EAAE;IACpE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE;QAC9B,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,KAAK;QACnC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,GAAG;QACzB,MAAM,EAAE,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,CAAU,EACV,SAAyB,EACzB,UAA2C,EAAE;IAE7C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,UAAU,CACxB,CAAU,EACV,QAA8B,EAC9B,UAA2C,EAAE;IAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,UAAU,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAAC;IAC/C,CAAC;AACH,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,OAAO,8BAA8B,UAAU,YAAY,KAAK,MAAM,CAAC;AACzE,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,13 @@
+export type AuthErrorCode = "unauthenticated" | "forbidden" | "invalid_session" | "csrf_invalid" | "unsafe_redirect";
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly status: number;
+    constructor(code: AuthErrorCode, message?: string, status?: number);
+    static defaultStatus(code: AuthErrorCode): number;
+    /** Safe for client responses — no secrets or internal details. */
+    toJSON(): {
+        code: AuthErrorCode;
+        message: string;
+    };
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GACrB,iBAAiB,GACjB,WAAW,GACX,iBAAiB,GACjB,cAAc,GACd,iBAAiB,CAAC;AAEtB,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAOlE,MAAM,CAAC,aAAa,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM;IAejD,kEAAkE;IAClE,MAAM,IAAI;QAAE,IAAI,EAAE,aAAa,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;CAGnD"}

package/dist/errors.js

@@ -0,0 +1,29 @@
+export class AuthError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message ?? code);
+        this.name = "AuthError";
+        this.code = code;
+        this.status = status ?? AuthError.defaultStatus(code);
+    }
+    static defaultStatus(code) {
+        switch (code) {
+            case "unauthenticated":
+            case "invalid_session":
+                return 401;
+            case "forbidden":
+            case "csrf_invalid":
+                return 403;
+            case "unsafe_redirect":
+                return 400;
+            default:
+                return 401;
+        }
+    }
+    /** Safe for client responses — no secrets or internal details. */
+    toJSON() {
+        return { code: this.code, message: this.message };
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAOA,MAAM,OAAO,SAAU,SAAQ,KAAK;IACzB,IAAI,CAAgB;IACpB,MAAM,CAAS;IAExB,YAAY,IAAmB,EAAE,OAAgB,EAAE,MAAe;QAChE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,IAAI,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,CAAC,aAAa,CAAC,IAAmB;QACtC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,iBAAiB,CAAC;YACvB,KAAK,iBAAiB;gBACpB,OAAO,GAAG,CAAC;YACb,KAAK,WAAW,CAAC;YACjB,KAAK,cAAc;gBACjB,OAAO,GAAG,CAAC;YACb,KAAK,iBAAiB;gBACpB,OAAO,GAAG,CAAC;YACb;gBACE,OAAO,GAAG,CAAC;QACf,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,MAAM;QACJ,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,16 @@
+export { randomToken, sha256, sha256Async } from "./crypto.js";
+export { assertCsrf, createCsrfToken, CSRF_FIELD, csrfHiddenInput, DEFAULT_CSRF_COOKIE, ensureCsrfCookie, verifyCsrf, type CsrfOptions, } from "./csrf.js";
+export { AuthError, type AuthErrorCode } from "./errors.js";
+export { createAuthHelpers, authFromOtokContext, readContextUser, toAuthSession, type AuthHelpers, type AuthBoundHelpers, type AuthHelpersOptions, } from "./context.js";
+export { defineLoader, defineAction } from "./loader.js";
+export { safeRedirectPath, safeNextPath } from "./redirect.js";
+export { getAuthRuntime, tryGetAuthRuntime, registerAuthRuntime, getSession, requireUser, requireRole, type AuthRuntime, } from "./registry.js";
+export { default, createAuthRuntime, configureAuthApp } from "./plugin.js";
+export { createApiGuard, createCsrfMiddleware, createRequireAuthMiddleware, composeMiddleware, createRequireRoleMiddleware, createSessionContextMiddleware, createTenantMiddleware, type RequireAuthOptions, type RequireRoleMiddlewareOptions, type SessionContextMiddlewareOptions, type TenantMiddlewareOptions, } from "./middleware/index.js";
+export { createSessionManager, type CreateSessionRecordInput, type ResolvedSessionRecord, type SessionAdapter, type SessionConfig, type SessionManager, } from "./session/index.js";
+export { hashPassword, verifyPassword } from "./password.js";
+export { hashPasswordWebCrypto, verifyPasswordWebCrypto } from "./password-webcrypto.js";
+export { createMemorySessionAdapter, type MemorySessionAdapterOptions, type MemorySessionPersistence, type MemorySessionRecord, } from "./adapters/index.js";
+export { createKyselySessionAdapter, SESSION_TABLE_MIGRATION_SQL, type KyselySessionAdapterOptions, } from "./adapters/kysely.js";
+export type { AuthUser, AuthSession, AuthPluginOptions, AuthPluginSessionOptions } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,UAAU,EACV,eAAe,EACf,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,aAAa,EACb,KAAK,WAAW,EAChB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,GACxB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,WAAW,EACX,KAAK,WAAW,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,kBAAkB,EACvB,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,GAC7B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,EACpB,KAAK,wBAAwB,EAC7B,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,cAAc,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EACL,0BAA0B,EAC1B,KAAK,2BAA2B,EAChC,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,2BAA2B,GACjC,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,QAAQ,EAAE,WAAW,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+export { randomToken, sha256, sha256Async } from "./crypto.js";
+export { assertCsrf, createCsrfToken, CSRF_FIELD, csrfHiddenInput, DEFAULT_CSRF_COOKIE, ensureCsrfCookie, verifyCsrf, } from "./csrf.js";
+export { AuthError } from "./errors.js";
+export { createAuthHelpers, authFromOtokContext, readContextUser, toAuthSession, } from "./context.js";
+export { defineLoader, defineAction } from "./loader.js";
+export { safeRedirectPath, safeNextPath } from "./redirect.js";
+export { getAuthRuntime, tryGetAuthRuntime, registerAuthRuntime, getSession, requireUser, requireRole, } from "./registry.js";
+export { default, createAuthRuntime, configureAuthApp } from "./plugin.js";
+export { createApiGuard, createCsrfMiddleware, createRequireAuthMiddleware, composeMiddleware, createRequireRoleMiddleware, createSessionContextMiddleware, createTenantMiddleware, } from "./middleware/index.js";
+export { createSessionManager, } from "./session/index.js";
+export { hashPassword, verifyPassword } from "./password.js";
+export { hashPasswordWebCrypto, verifyPasswordWebCrypto } from "./password-webcrypto.js";
+export { createMemorySessionAdapter, } from "./adapters/index.js";
+export { createKyselySessionAdapter, SESSION_TABLE_MIGRATION_SQL, } from "./adapters/kysely.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EACL,UAAU,EACV,eAAe,EACf,UAAU,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,GAEX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,SAAS,EAAsB,MAAM,aAAa,CAAC;AAC5D,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,eAAe,EACf,aAAa,GAId,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC/D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,mBAAmB,EACnB,UAAU,EACV,WAAW,EACX,WAAW,GAEZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,2BAA2B,EAC3B,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,GAKvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,oBAAoB,GAMrB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EACL,0BAA0B,GAI3B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,GAE5B,MAAM,sBAAsB,CAAC"}

package/dist/loader.d.ts

@@ -0,0 +1,24 @@
+import type { LoaderResult, OtokActionContext, OtokContext, OtokLoader } from "@kamod-ch/otok/server";
+import type { AuthBoundHelpers } from "./context.js";
+import type { AuthUser } from "./types.js";
+type LoaderAuthContext<TUser extends AuthUser = AuthUser> = {
+    auth: AuthBoundHelpers<TUser>;
+};
+type ActionAuthContext<TUser extends AuthUser = AuthUser> = LoaderAuthContext<TUser>;
+/**
+ * Wrap a loader with typed `auth` helpers from the registered otok-auth runtime.
+ *
+ * ```ts
+ * export const loader = defineLoader(async ({ auth }) => {
+ *   const user = await auth.requireUser();
+ *   return { user };
+ * });
+ * ```
+ */
+export declare function defineLoader<Data extends LoaderResult>(handler: (ctx: OtokContext & LoaderAuthContext) => Data | Promise<Data>): OtokLoader<Data>;
+/**
+ * Wrap an action with typed `auth` helpers from the registered otok-auth runtime.
+ */
+export declare function defineAction<Result>(handler: (ctx: OtokActionContext & ActionAuthContext) => Result | Promise<Result>): (context: OtokActionContext) => Result | Promise<Result>;
+export {};
+//# sourceMappingURL=loader.d.ts.map

package/dist/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtG,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGrD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C,KAAK,iBAAiB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,IAAI;IAC1D,IAAI,EAAE,gBAAgB,CAAC,KAAK,CAAC,CAAC;CAC/B,CAAC;AAEF,KAAK,iBAAiB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ,IAAI,iBAAiB,CAAC,KAAK,CAAC,CAAC;AAarF;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAAC,IAAI,SAAS,YAAY,EACpD,OAAO,EAAE,CAAC,GAAG,EAAE,WAAW,GAAG,iBAAiB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,GACtE,UAAU,CAAC,IAAI,CAAC,CAElB;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EACjC,OAAO,EAAE,CAAC,GAAG,EAAE,iBAAiB,GAAG,iBAAiB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAChF,CAAC,OAAO,EAAE,iBAAiB,KAAK,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE1D"}

package/dist/loader.js

@@ -0,0 +1,30 @@
+import { authFromOtokContext } from "./context.js";
+import { tryGetAuthRuntime } from "./registry.js";
+function resolveAuth(hono) {
+    const runtime = tryGetAuthRuntime();
+    if (!runtime) {
+        throw new Error("otok-auth: defineLoader requires auth() plugin or registerAuthRuntime(). " +
+            "Use loader: ({ hono }) => ... with getSession(hono) for manual wiring.");
+    }
+    return authFromOtokContext(hono, runtime.helpers);
+}
+/**
+ * Wrap a loader with typed `auth` helpers from the registered otok-auth runtime.
+ *
+ * ```ts
+ * export const loader = defineLoader(async ({ auth }) => {
+ *   const user = await auth.requireUser();
+ *   return { user };
+ * });
+ * ```
+ */
+export function defineLoader(handler) {
+    return (context) => handler({ ...context, auth: resolveAuth(context.hono) });
+}
+/**
+ * Wrap an action with typed `auth` helpers from the registered otok-auth runtime.
+ */
+export function defineAction(handler) {
+    return (context) => handler({ ...context, auth: resolveAuth(context.hono) });
+}
+//# sourceMappingURL=loader.js.map

package/dist/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../src/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AASlD,SAAS,WAAW,CAAyB,IAAyB;IACpE,MAAM,OAAO,GAAG,iBAAiB,EAAS,CAAC;IAC3C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CACb,2EAA2E;YACzE,wEAAwE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAuE;IAEvE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,OAAiF;IAEjF,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC/E,CAAC"}

package/dist/middleware/api-guard.d.ts

@@ -0,0 +1,3 @@
+import type { Context } from "hono";
+export declare function createApiGuard<TUser>(getUser: (c: Context) => Promise<TUser | null>): (c: Context) => Promise<TUser | null>;
+//# sourceMappingURL=api-guard.d.ts.map

package/dist/middleware/api-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-guard.d.ts","sourceRoot":"","sources":["../../src/middleware/api-guard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,wBAAgB,cAAc,CAAC,KAAK,EAClC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,GAC7C,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAEvC"}

package/dist/middleware/api-guard.js

@@ -0,0 +1,4 @@
+export function createApiGuard(getUser) {
+    return (c) => getUser(c);
+}
+//# sourceMappingURL=api-guard.js.map

package/dist/middleware/api-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-guard.js","sourceRoot":"","sources":["../../src/middleware/api-guard.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,cAAc,CAC5B,OAA8C;IAE9C,OAAO,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3B,CAAC"}

package/dist/middleware/csrf.d.ts

@@ -0,0 +1,4 @@
+import { type OtokMiddleware } from "@kamod-ch/otok/server";
+import { type CsrfOptions } from "../csrf.js";
+export declare function createCsrfMiddleware(options?: CsrfOptions): OtokMiddleware;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/middleware/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAgC,KAAK,WAAW,EAAE,MAAM,YAAY,CAAC;AAE5E,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,WAAgB,GAAG,cAAc,CAsB9E"}

package/dist/middleware/csrf.js

@@ -0,0 +1,22 @@
+import { defineMiddleware } from "@kamod-ch/otok/server";
+import { assertCsrf, ensureCsrfCookie } from "../csrf.js";
+export function createCsrfMiddleware(options = {}) {
+    return defineMiddleware(async (c, next) => {
+        const method = c.req.method.toUpperCase();
+        if (method === "GET" || method === "HEAD") {
+            ensureCsrfCookie(c, options);
+            await next();
+            return;
+        }
+        if (method === "POST" || method === "PUT" || method === "PATCH" || method === "DELETE") {
+            const contentType = c.req.header("content-type") ?? "";
+            if (contentType.includes("application/x-www-form-urlencoded") ||
+                contentType.includes("multipart/form-data")) {
+                const formData = await c.req.raw.clone().formData();
+                assertCsrf(c, formData, options);
+            }
+        }
+        await next();
+    });
+}
+//# sourceMappingURL=csrf.js.map

package/dist/middleware/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../../src/middleware/csrf.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAuB,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAoB,MAAM,YAAY,CAAC;AAE5E,MAAM,UAAU,oBAAoB,CAAC,UAAuB,EAAE;IAC5D,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC1C,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvF,MAAM,WAAW,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;YACvD,IACE,WAAW,CAAC,QAAQ,CAAC,mCAAmC,CAAC;gBACzD,WAAW,CAAC,QAAQ,CAAC,qBAAqB,CAAC,EAC3C,CAAC;gBACD,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC;gBACpD,UAAU,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,5 @@
+export { createApiGuard } from "./api-guard.js";
+export { createCsrfMiddleware } from "./csrf.js";
+export { createRequireAuthMiddleware, type RequireAuthOptions } from "./require-auth.js";
+export { composeMiddleware, createRequireRoleMiddleware, createSessionContextMiddleware, createTenantMiddleware, type RequireRoleMiddlewareOptions, type SessionContextMiddlewareOptions, type TenantMiddlewareOptions, } from "./rbac.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,KAAK,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,EACtB,KAAK,4BAA4B,EACjC,KAAK,+BAA+B,EACpC,KAAK,uBAAuB,GAC7B,MAAM,WAAW,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,5 @@
+export { createApiGuard } from "./api-guard.js";
+export { createCsrfMiddleware } from "./csrf.js";
+export { createRequireAuthMiddleware } from "./require-auth.js";
+export { composeMiddleware, createRequireRoleMiddleware, createSessionContextMiddleware, createTenantMiddleware, } from "./rbac.js";
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAA2B,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,iBAAiB,EACjB,2BAA2B,EAC3B,8BAA8B,EAC9B,sBAAsB,GAIvB,MAAM,WAAW,CAAC"}

package/dist/middleware/rbac.d.ts

@@ -0,0 +1,26 @@
+import type { Context } from "hono";
+import { type OtokMiddleware } from "@kamod-ch/otok/server";
+export interface SessionContextMiddlewareOptions<TUser> {
+    /** Defaults to `c.get("user")`. */
+    getUser?: (c: Context) => TUser | undefined;
+    set: Record<string, (user: TUser) => unknown>;
+}
+export declare function createSessionContextMiddleware<TUser>(options: SessionContextMiddlewareOptions<TUser>): OtokMiddleware;
+export interface TenantMiddlewareOptions<TUser> {
+    getUser?: (c: Context) => TUser | undefined;
+    getTenantId: (user: TUser) => string;
+    /** Defaults to `tenantId`. Use `organizationId`, `workspaceId`, etc. */
+    contextKey?: string;
+    also?: Record<string, (user: TUser) => unknown>;
+}
+export declare function createTenantMiddleware<TUser>(options: TenantMiddlewareOptions<TUser>): OtokMiddleware;
+export interface RequireRoleMiddlewareOptions<TUser, TRole extends string = string> {
+    getUser?: (c: Context) => TUser | undefined;
+    getRole: (user: TUser) => TRole;
+    allowed: readonly TRole[];
+    loginPath?: string;
+    message?: string;
+}
+export declare function createRequireRoleMiddleware<TUser, TRole extends string = string>(options: RequireRoleMiddlewareOptions<TUser, TRole>): OtokMiddleware;
+export declare function composeMiddleware(...middlewares: OtokMiddleware[]): OtokMiddleware;
+//# sourceMappingURL=rbac.d.ts.map

package/dist/middleware/rbac.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.d.ts","sourceRoot":"","sources":["../../src/middleware/rbac.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAAoC,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAO9F,MAAM,WAAW,+BAA+B,CAAC,KAAK;IACpD,mCAAmC;IACnC,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC;CAC/C;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAClD,OAAO,EAAE,+BAA+B,CAAC,KAAK,CAAC,GAC9C,cAAc,CAWhB;AAED,MAAM,WAAW,uBAAuB,CAAC,KAAK;IAC5C,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC;IACrC,wEAAwE;IACxE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC;CACjD;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAC1C,OAAO,EAAE,uBAAuB,CAAC,KAAK,CAAC,GACtC,cAAc,CAShB;AAED,MAAM,WAAW,4BAA4B,CAAC,KAAK,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IAChF,OAAO,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,KAAK,GAAG,SAAS,CAAC;IAC5C,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,KAAK,CAAC;IAChC,OAAO,EAAE,SAAS,KAAK,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,EAC9E,OAAO,EAAE,4BAA4B,CAAC,KAAK,EAAE,KAAK,CAAC,GAClD,cAAc,CAehB;AAED,wBAAgB,iBAAiB,CAAC,GAAG,WAAW,EAAE,cAAc,EAAE,GAAG,cAAc,CAqBlF"}

package/dist/middleware/rbac.js

@@ -0,0 +1,63 @@
+import { defineMiddleware, fail, redirect } from "@kamod-ch/otok/server";
+function readUser(c, getUser) {
+    if (getUser)
+        return getUser(c);
+    return c.get("user");
+}
+export function createSessionContextMiddleware(options) {
+    return defineMiddleware(async (c, next) => {
+        const user = readUser(c, options.getUser);
+        if (!user)
+            redirect("/login", 303);
+        for (const [key, getter] of Object.entries(options.set)) {
+            c.set(key, getter(user));
+        }
+        await next();
+    });
+}
+export function createTenantMiddleware(options) {
+    const contextKey = options.contextKey ?? "tenantId";
+    return createSessionContextMiddleware({
+        getUser: options.getUser,
+        set: {
+            [contextKey]: options.getTenantId,
+            ...options.also,
+        },
+    });
+}
+export function createRequireRoleMiddleware(options) {
+    const loginPath = options.loginPath ?? "/login";
+    const message = options.message ?? "Insufficient permissions";
+    return defineMiddleware(async (c, next) => {
+        const user = readUser(c, options.getUser);
+        if (!user)
+            redirect(loginPath, 303);
+        const role = options.getRole(user);
+        if (!options.allowed.includes(role)) {
+            fail(403, { formErrors: [message] });
+        }
+        await next();
+    });
+}
+export function composeMiddleware(...middlewares) {
+    return defineMiddleware(async (c, next) => {
+        async function dispatch(index) {
+            const middleware = middlewares[index];
+            if (!middleware) {
+                await next();
+                return undefined;
+            }
+            let downstream;
+            const result = await middleware(c, async () => {
+                downstream = await dispatch(index + 1);
+            });
+            if (result instanceof Response)
+                return result;
+            return downstream;
+        }
+        const response = await dispatch(0);
+        if (response instanceof Response)
+            return response;
+    });
+}
+//# sourceMappingURL=rbac.js.map

package/dist/middleware/rbac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rbac.js","sourceRoot":"","sources":["../../src/middleware/rbac.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAuB,MAAM,uBAAuB,CAAC;AAE9F,SAAS,QAAQ,CAAQ,CAAU,EAAE,OAA2C;IAC9E,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,GAAG,CAAC,MAAM,CAAsB,CAAC;AAC5C,CAAC;AAQD,MAAM,UAAU,8BAA8B,CAC5C,OAA+C;IAE/C,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEnC,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACxD,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;QAC3B,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAUD,MAAM,UAAU,sBAAsB,CACpC,OAAuC;IAEvC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,UAAU,CAAC;IACpD,OAAO,8BAA8B,CAAQ;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE;YACH,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC,WAAW;YACjC,GAAG,OAAO,CAAC,IAAI;SAChB;KACF,CAAC,CAAC;AACL,CAAC;AAUD,MAAM,UAAU,2BAA2B,CACzC,OAAmD;IAEnD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC;IAE9D,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAEpC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAG,WAA6B;IAChE,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,KAAK,UAAU,QAAQ,CAAC,KAAa;YACnC,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,UAAgC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,EAAE;gBAC5C,UAAU,GAAG,MAAM,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACzC,CAAC,CAAC,CAAC;YAEH,IAAI,MAAM,YAAY,QAAQ;gBAAE,OAAO,MAAM,CAAC;YAC9C,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,CAAC,CAAC,CAAC;QACnC,IAAI,QAAQ,YAAY,QAAQ;YAAE,OAAO,QAAQ,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/middleware/require-auth.d.ts

@@ -0,0 +1,11 @@
+import type { Context } from "hono";
+import { type OtokMiddleware } from "@kamod-ch/otok/server";
+export interface RequireAuthOptions<TUser> {
+    getUser: (c: Context) => Promise<TUser | null>;
+    loginPath?: string;
+    publicPaths?: Iterable<string>;
+    contextKey?: string;
+    onAuthenticated?: (c: Context, user: TUser) => void;
+}
+export declare function createRequireAuthMiddleware<TUser>(options: RequireAuthOptions<TUser>): OtokMiddleware;
+//# sourceMappingURL=require-auth.d.ts.map

package/dist/middleware/require-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-auth.d.ts","sourceRoot":"","sources":["../../src/middleware/require-auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACpC,OAAO,EAA8B,KAAK,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAExF,MAAM,WAAW,kBAAkB,CAAC,KAAK;IACvC,OAAO,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IAC/C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,KAAK,IAAI,CAAC;CACrD;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAC/C,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC,GACjC,cAAc,CAiBhB"}

package/dist/middleware/require-auth.js

@@ -0,0 +1,20 @@
+import { defineMiddleware, redirect } from "@kamod-ch/otok/server";
+export function createRequireAuthMiddleware(options) {
+    const loginPath = options.loginPath ?? "/login";
+    const publicPaths = new Set(options.publicPaths ?? []);
+    const contextKey = options.contextKey ?? "user";
+    return defineMiddleware(async (c, next) => {
+        const pathname = new URL(c.req.url).pathname;
+        if (publicPaths.has(pathname)) {
+            await next();
+            return;
+        }
+        const user = await options.getUser(c);
+        if (!user)
+            redirect(loginPath, 303);
+        c.set(contextKey, user);
+        options.onAuthenticated?.(c, user);
+        await next();
+    });
+}
+//# sourceMappingURL=require-auth.js.map

package/dist/middleware/require-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"require-auth.js","sourceRoot":"","sources":["../../src/middleware/require-auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,QAAQ,EAAuB,MAAM,uBAAuB,CAAC;AAUxF,MAAM,UAAU,2BAA2B,CACzC,OAAkC;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,QAAQ,CAAC;IAChD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC;IAEhD,OAAO,gBAAgB,CAAC,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACxC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;QAC7C,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,CAAC,IAAI;YAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACpC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QACxB,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QACnC,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/password-webcrypto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Edge-safe password hashing via Web Crypto PBKDF2 (Workers / browsers / Node 20+).
+ * Prefer `@node-rs/argon2` (`hashPassword` / `verifyPassword`) on Node when available.
+ *
+ * Encoded format: `pbkdf2$iterations$saltB64$hashB64`
+ */
+export declare function hashPasswordWebCrypto(password: string, options?: {
+    iterations?: number;
+}): Promise<string>;
+export declare function verifyPasswordWebCrypto(passwordHash: string, password: string): Promise<boolean>;
+//# sourceMappingURL=password-webcrypto.d.ts.map

package/dist/password-webcrypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-webcrypto.d.ts","sourceRoot":"","sources":["../src/password-webcrypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyDH,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAChC,OAAO,CAAC,MAAM,CAAC,CAKjB;AAED,wBAAsB,uBAAuB,CAC3C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CASlB"}

package/dist/password-webcrypto.js

@@ -0,0 +1,65 @@
+/**
+ * Edge-safe password hashing via Web Crypto PBKDF2 (Workers / browsers / Node 20+).
+ * Prefer `@node-rs/argon2` (`hashPassword` / `verifyPassword`) on Node when available.
+ *
+ * Encoded format: `pbkdf2$iterations$saltB64$hashB64`
+ */
+const DEFAULT_ITERATIONS = 310_000;
+const SALT_BYTES = 16;
+const KEY_BITS = 256;
+function toBase64(bytes) {
+    if (typeof Buffer !== "undefined") {
+        return Buffer.from(bytes).toString("base64");
+    }
+    let binary = "";
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+function fromBase64(value) {
+    if (typeof Buffer !== "undefined") {
+        return new Uint8Array(Buffer.from(value, "base64"));
+    }
+    const binary = atob(value);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i++)
+        bytes[i] = binary.charCodeAt(i);
+    return bytes;
+}
+function timingSafeEqual(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a[i] ^ b[i];
+    return diff === 0;
+}
+async function deriveKey(password, salt, iterations) {
+    const material = await crypto.subtle.importKey("raw", new TextEncoder().encode(password), "PBKDF2", false, ["deriveBits"]);
+    const bits = await crypto.subtle.deriveBits({
+        name: "PBKDF2",
+        hash: "SHA-256",
+        salt: salt,
+        iterations,
+    }, material, KEY_BITS);
+    return new Uint8Array(bits);
+}
+export async function hashPasswordWebCrypto(password, options) {
+    const iterations = options?.iterations ?? DEFAULT_ITERATIONS;
+    const salt = crypto.getRandomValues(new Uint8Array(SALT_BYTES));
+    const hash = await deriveKey(password, salt, iterations);
+    return `pbkdf2$${iterations}$${toBase64(salt)}$${toBase64(hash)}`;
+}
+export async function verifyPasswordWebCrypto(passwordHash, password) {
+    const parts = passwordHash.split("$");
+    if (parts.length !== 4 || parts[0] !== "pbkdf2")
+        return false;
+    const iterations = Number(parts[1]);
+    if (!Number.isFinite(iterations) || iterations < 1000)
+        return false;
+    const salt = fromBase64(parts[2]);
+    const expected = fromBase64(parts[3]);
+    const actual = await deriveKey(password, salt, iterations);
+    return timingSafeEqual(actual, expected);
+}
+//# sourceMappingURL=password-webcrypto.js.map

package/dist/password-webcrypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-webcrypto.js","sourceRoot":"","sources":["../src/password-webcrypto.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,kBAAkB,GAAG,OAAO,CAAC;AACnC,MAAM,UAAU,GAAG,EAAE,CAAC;AACtB,MAAM,QAAQ,GAAG,GAAG,CAAC;AAErB,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;IACtD,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAAa,EAAE,CAAa;IACnD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;IACzD,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,QAAgB,EAChB,IAAgB,EAChB,UAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5C,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,EAClC,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,IAAoB;QAC1B,UAAU;KACX,EACD,QAAQ,EACR,QAAQ,CACT,CAAC;IACF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,QAAgB,EAChB,OAAiC;IAEjC,MAAM,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,kBAAkB,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACzD,OAAO,UAAU,UAAU,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,YAAoB,EACpB,QAAgB;IAEhB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,IAAI;QAAE,OAAO,KAAK,CAAC;IACpE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3D,OAAO,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC3C,CAAC"}

package/dist/password.d.ts

@@ -0,0 +1,3 @@
+export declare function hashPassword(password: string): Promise<string>;
+export declare function verifyPassword(passwordHash: string, password: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAEA,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAEpE;AAED,wBAAsB,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7F"}

package/dist/password.js

@@ -0,0 +1,8 @@
+import { hash, verify } from "@node-rs/argon2";
+export async function hashPassword(password) {
+    return hash(password, { algorithm: 2 });
+}
+export async function verifyPassword(passwordHash, password) {
+    return verify(passwordHash, password);
+}
+//# sourceMappingURL=password.js.map

package/dist/password.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../src/password.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,YAAoB,EAAE,QAAgB;IACzE,OAAO,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,19 @@
+import type { Hono } from "hono";
+import { createAuthHelpers } from "./context.js";
+import { createCsrfMiddleware } from "./middleware/csrf.js";
+import { createRequireAuthMiddleware } from "./middleware/require-auth.js";
+import { createSessionManager } from "./session/manager.js";
+import type { AuthPluginOptions, AuthUser } from "./types.js";
+declare function configureAuthApp(app: Hono, options: AuthPluginOptions): void;
+/** Otok plugin factory — register after `auth()` in otok.config.ts. */
+export default function auth(options: AuthPluginOptions): import("@kamod-ch/otok-config").OtokPlugin<unknown>;
+/** Factory for programmatic (non-plugin) setup — same options as the plugin. */
+export declare function createAuthRuntime<TUser extends AuthUser>(options: AuthPluginOptions<TUser>): ReturnType<typeof createAuthHelpers<TUser>> & {
+    sessions: ReturnType<typeof createSessionManager<TUser>>;
+    middleware: {
+        requireAuth: ReturnType<typeof createRequireAuthMiddleware<TUser>>;
+        csrf: ReturnType<typeof createCsrfMiddleware>;
+    };
+};
+export { configureAuthApp };
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAEjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAE3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAC5D,OAAO,KAAK,EAAE,iBAAiB,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAc9D,iBAAS,gBAAgB,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,iBAAiB,GAAG,IAAI,CAkDrE;AA6BD,uEAAuE;AACvE,MAAM,CAAC,OAAO,UAAU,IAAI,CAAC,OAAO,EAAE,iBAAiB,uDAMtD;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,KAAK,SAAS,QAAQ,EACtD,OAAO,EAAE,iBAAiB,CAAC,KAAK,CAAC,GAChC,UAAU,CAAC,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAC,GAAG;IAC/C,QAAQ,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,UAAU,EAAE;QACV,WAAW,EAAE,UAAU,CAAC,OAAO,2BAA2B,CAAC,KAAK,CAAC,CAAC,CAAC;QACnE,IAAI,EAAE,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC;KAC/C,CAAC;CACH,CAyCA;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAC"}